From bf4e01c2711e6c95559d40a89e666806176b12de Mon Sep 17 00:00:00 2001 From: Andrei Draganescu Date: Mon, 7 Sep 2026 15:21:25 +0300 Subject: [PATCH 1/3] General: Bump the pinned hash for Gutenberg to `8ae0957`. This updates the pinned commit hash of the Gutenberg repository from `943e0d825bb66ba582e9a10d32743cbb136de460` to `8ae0957cfa0b3e5c270e75656a55591debc6def0`. A full list of changes included in this commit can be found on GitHub: https://github.com/WordPress/gutenberg/compare/943e0d825bb66ba582e9a10d32743cbb136de460...8ae0957cfa0b3e5c270e75656a55591debc6def0 - useViewConfig: don't request the view config twice (https://github.com/WordPress/gutenberg/pull/82183) - Block Editor: Add translator context to pseudo-state labels (https://github.com/WordPress/gutenberg/pull/81770) - Post Editor: Fix 403 on /wp/v2/settings at boot for users without manage_options cap (https://github.com/WordPress/gutenberg/pull/81813) - Media: Refuse a multi-file drop on a placeholder that takes one file (https://github.com/WordPress/gutenberg/pull/82046) - List: outdent an empty middle item without adding an item (https://github.com/WordPress/gutenberg/pull/82011) - Accordion Panel: Reset padding-block when panel is hidden (https://github.com/WordPress/gutenberg/pull/81782) - List View: Don't focus the last Table cell on keyboard activation (https://github.com/WordPress/gutenberg/pull/81964) - Media: Stop claiming "Upload complete" when upload failed (https://github.com/WordPress/gutenberg/pull/81397) - Media: keep indexed PNG sub-sizes indexed (https://github.com/WordPress/gutenberg/pull/81884) - Image block cropping: Sync image size and link destination settings (https://github.com/WordPress/gutenberg/pull/82316) - Gallery block: Fix 'Crop images to fit' broken in editor (https://github.com/WordPress/gutenberg/pull/82318) - Pages: require authentication and a capability to render generated standalone pages (https://github.com/WordPress/gutenberg/pull/82254) - Media Utils: Preserve arrays in multipart form data (https://github.com/WordPress/gutenberg/pull/82353) - wp-env: Fix Docker build errors with Debian Bullseye repositories (https://github.com/WordPress/gutenberg/pull/82478) - Query Loop: Fall back to `post` when the query has no `postType` (https://github.com/WordPress/gutenberg/pull/82465) - Block Supports: Bail early in state styles when a block has no style attribute (https://github.com/WordPress/gutenberg/pull/81908) - Fix: Restore layout styles for block style variations (https://github.com/WordPress/gutenberg/pull/82335) See #66037. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01DP49q1JdSxUhzFFE7ga2DS --- package.json | 2 +- .../assets/script-loader-packages.php | 14 +++++++------- .../assets/script-modules-packages.php | 2 +- .../build/pages/font-library/page.php | 16 ++++++++++++++++ .../build/pages/options-connectors/page.php | 16 ++++++++++++++++ 5 files changed, 41 insertions(+), 9 deletions(-) diff --git a/package.json b/package.json index 78e1ca7c8f860..f2ec428c79bf0 100644 --- a/package.json +++ b/package.json @@ -7,7 +7,7 @@ "url": "https://develop.svn.wordpress.org/trunk" }, "gutenberg": { - "sha": "943e0d825bb66ba582e9a10d32743cbb136de460", + "sha": "8ae0957cfa0b3e5c270e75656a55591debc6def0", "ghcrRepo": "WordPress/gutenberg/gutenberg-wp-develop-build" }, "engines": { diff --git a/src/wp-includes/assets/script-loader-packages.php b/src/wp-includes/assets/script-loader-packages.php index 21e7a8223b386..2dcb50aa686b5 100644 --- a/src/wp-includes/assets/script-loader-packages.php +++ b/src/wp-includes/assets/script-loader-packages.php @@ -104,7 +104,7 @@ 'wp-url', 'wp-warning' ), - 'version' => 'd3cbb2c45b145b27a5cf' + 'version' => '37e58da384b2558bd479' ), 'block-library.js' => array( 'dependencies' => array( @@ -150,7 +150,7 @@ 'import' => 'dynamic' ) ), - 'version' => '2e80403676c10cc0a473' + 'version' => '00e6e2a44788af201f35' ), 'block-serialization-default-parser.js' => array( 'dependencies' => array( @@ -402,7 +402,7 @@ 'import' => 'static' ) ), - 'version' => 'a7750dea8d5c880ddf33' + 'version' => 'a6cb1641d13f718c01bd' ), 'edit-site.js' => array( 'dependencies' => array( @@ -452,7 +452,7 @@ 'import' => 'static' ) ), - 'version' => '638e98d0061f4b9f1efb' + 'version' => '008f89f2cb2ad17a5947' ), 'edit-widgets.js' => array( 'dependencies' => array( @@ -543,7 +543,7 @@ 'import' => 'static' ) ), - 'version' => '2cd3b932f41a420d5904' + 'version' => '1beaeebde7484b6bf3e3' ), 'element.js' => array( 'dependencies' => array( @@ -663,7 +663,7 @@ 'wp-url', 'wp-warning' ), - 'version' => 'b8bf604c1cc119e63ee6' + 'version' => '07c1c94f9b21baa97a96' ), 'notices.js' => array( 'dependencies' => array( @@ -881,7 +881,7 @@ 'import' => 'dynamic' ) ), - 'version' => 'f7174b0617bcd68e57c3' + 'version' => '996352700f53b76866a5' ), 'url.js' => array( 'dependencies' => array( diff --git a/src/wp-includes/assets/script-modules-packages.php b/src/wp-includes/assets/script-modules-packages.php index 7b0b8f43fac9f..b0ffb34320fbc 100644 --- a/src/wp-includes/assets/script-modules-packages.php +++ b/src/wp-includes/assets/script-modules-packages.php @@ -360,7 +360,7 @@ 'dependencies' => array( ), - 'version' => '685442d334b2d3e70832' + 'version' => '7e33cd8c4128731126e8' ), 'workflow/index.js' => array( 'dependencies' => array( diff --git a/src/wp-includes/build/pages/font-library/page.php b/src/wp-includes/build/pages/font-library/page.php index 0aaec2d145acf..194ca74f57b7f 100644 --- a/src/wp-includes/build/pages/font-library/page.php +++ b/src/wp-includes/build/pages/font-library/page.php @@ -310,6 +310,22 @@ function ( $handle ) { function wp_font_library_intercept_render() { // phpcs:ignore WordPress.Security.NonceVerification.Recommended if ( isset( $_GET['page'] ) && 'font-library' === $_GET['page'] ) { + // The page renders outside the menu page callback flow, so it must + // enforce authentication and capability checks itself. Without this, + // any admin entry point firing `admin_init` (such as admin-post.php, + // which serves logged-out requests) would render the page for + // unauthenticated visitors. + if ( ! is_user_logged_in() ) { + auth_redirect(); + } + + if ( ! current_user_can( 'edit_theme_options' ) ) { + wp_die( + __( 'Sorry, you are not allowed to access this page.' ), + 403 + ); + } + wp_font_library_render_page(); exit; } diff --git a/src/wp-includes/build/pages/options-connectors/page.php b/src/wp-includes/build/pages/options-connectors/page.php index 7695969c7c060..c219fc397eb48 100644 --- a/src/wp-includes/build/pages/options-connectors/page.php +++ b/src/wp-includes/build/pages/options-connectors/page.php @@ -310,6 +310,22 @@ function ( $handle ) { function wp_options_connectors_intercept_render() { // phpcs:ignore WordPress.Security.NonceVerification.Recommended if ( isset( $_GET['page'] ) && 'options-connectors' === $_GET['page'] ) { + // The page renders outside the menu page callback flow, so it must + // enforce authentication and capability checks itself. Without this, + // any admin entry point firing `admin_init` (such as admin-post.php, + // which serves logged-out requests) would render the page for + // unauthenticated visitors. + if ( ! is_user_logged_in() ) { + auth_redirect(); + } + + if ( ! current_user_can( 'manage_options' ) ) { + wp_die( + __( 'Sorry, you are not allowed to access this page.' ), + 403 + ); + } + wp_options_connectors_render_page(); exit; } From ab48f86dba8781b589ba9ab424d539de43873508 Mon Sep 17 00:00:00 2001 From: adamsilverstein Date: Wed, 9 Sep 2026 16:59:28 -0700 Subject: [PATCH 2/3] General: Bump the pinned hash for Gutenberg to `3f82d42`. Re-pin to the current head of the WordPress/gutenberg#82383 cherry-pick branch, which adds the #81947, #82265, and #82249 backports on top of the previous pin. Only the `editor` and `upload-media` package hashes change in the regenerated manifest. See #66037. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01WRsjgMZe3xuN98DYxZ3Kf6 --- package.json | 2 +- src/wp-includes/assets/script-loader-packages.php | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package.json b/package.json index f2ec428c79bf0..ca86c6dae0d75 100644 --- a/package.json +++ b/package.json @@ -7,7 +7,7 @@ "url": "https://develop.svn.wordpress.org/trunk" }, "gutenberg": { - "sha": "8ae0957cfa0b3e5c270e75656a55591debc6def0", + "sha": "3f82d42667908afa5a04db1c7d646fbca0156a10", "ghcrRepo": "WordPress/gutenberg/gutenberg-wp-develop-build" }, "engines": { diff --git a/src/wp-includes/assets/script-loader-packages.php b/src/wp-includes/assets/script-loader-packages.php index 2dcb50aa686b5..c3be8dcd87916 100644 --- a/src/wp-includes/assets/script-loader-packages.php +++ b/src/wp-includes/assets/script-loader-packages.php @@ -543,7 +543,7 @@ 'import' => 'static' ) ), - 'version' => '1beaeebde7484b6bf3e3' + 'version' => 'af070cfff88093363220' ), 'element.js' => array( 'dependencies' => array( @@ -881,7 +881,7 @@ 'import' => 'dynamic' ) ), - 'version' => '996352700f53b76866a5' + 'version' => 'a2c026d433c295fd5145' ), 'url.js' => array( 'dependencies' => array( From e4af4960c6e4f418cbae2d00ab5e191e511a2a25 Mon Sep 17 00:00:00 2001 From: Andrei Draganescu Date: Thu, 10 Sep 2026 12:01:25 +0300 Subject: [PATCH 3/3] General: Bump the pinned hash for Gutenberg to `dd294ab`. Re-pins to the `wp/7.1` tip now that the 7.1.1 cherry-pick PR (WordPress/gutenberg#82383) has landed via rebase and merge. The build content is identical to the previous pin `3f82d42`, so the regenerated manifests are unchanged and only the pinned hash differs. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GXuW8W41AXnGkpT3hfEhzE --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index ca86c6dae0d75..8e0186df7b413 100644 --- a/package.json +++ b/package.json @@ -7,7 +7,7 @@ "url": "https://develop.svn.wordpress.org/trunk" }, "gutenberg": { - "sha": "3f82d42667908afa5a04db1c7d646fbca0156a10", + "sha": "dd294ab86ceaf9f3d7d42a09b78f399238ce8826", "ghcrRepo": "WordPress/gutenberg/gutenberg-wp-develop-build" }, "engines": {